Questions tagged [anti-debugging]
Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.
140 questions
2
votes
1
answer
2k
views
Conflict of OllyDbg plugins
I have recently started using plugins for OllyDbg 1.10. Thanks to this site, I have an idea of the capabilities of the plugins for OllyDbg.
As I have only a very basic idea of how plugins work, I ...
- 117
2
votes
0
answers
252
views
Ollydbg Instructions Are Splitted
When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like;
it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
- 21
7
votes
2
answers
2k
views
"Debugged application has modified the debugging registers" with ollydbg 2.01
I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:
Debugged application has modified the debugging registers.
Maybe it called ZwContinue() or ...
- 1,541
1
vote
3
answers
595
views
Finding memory breakpoints from debugged executable
Is it possible to find Memory Breakpoints from within the debugged executable? (as an anti debugging technique?). And no, i do not mean Hardware Breakpoints from the Dr0 - Dr7 registers NOR INT3 \ ...
- 668
10
votes
1
answer
3k
views
Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?
I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet.
Changing the code dynamically causes exceptions to occur ...
- 668
0
votes
1
answer
115
views
Where is the code for ollytlscatch?
I've been trying to get antiResHacker.exe as mentioned in this question:
How to prevent use of Resource editors
However, the codebase for ollytlscatch (https://code.google.com/p/ollytlscatch/) ...
- 233
7
votes
1
answer
4k
views
at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?
Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out.
I am reverse-engineering an application which at some point ...
- 668
2
votes
1
answer
832
views
Decompile injected SWF in a specific environment
I am trying to reverse a swf file that is loaded into a AS3 application and executed by that application. The problem is that the injected file is obfuscated and no decompiler could manage to show me ...
- 21
2
votes
0
answers
190
views
How can one debug a program that can only be started by other processes?
I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger.
The program starts by using a bash script wrapper to process input parameters, ...
1
vote
1
answer
4k
views
Defeat QueryPerformanceCounter as Anti-Debugging trick
The sample I try to analyze starts with PUSHAD. It begins with:
PUSHAD
MOV ESI, unbr002.0109D000
LEA EDI, DWORD PTR DS:[ESI+FFEA4000]
MOV DWORD PTR DS: [EDI+208C04], 8C1FE
PUSH EDI
...
- 1,541
6
votes
2
answers
2k
views
(linux) How to debug a "debugger"?
I'm trying to understand a program. This programm implements an antidebug technique.
From what I've understand so far, the father ptrace a forked process.
An the child does something like that:
...
- 121
2
votes
2
answers
970
views
Find sigtrap function
I'm reversing a program that uses a lot of BREAK/int 3 (Linux). I guess that the code contains something like:
void sigtrap_func(int sig) { (some stuff..) }
int main()
{
signal(SIGTRAP, ...
- 23
2
votes
2
answers
11k
views
Ollydbg and IDA Pro unable to attach to process
I have a target application protected with CrypKey.
When i try to attach to the apps in OllyDbg and Ida Pro i receive Unable to attach to this process.
The bad news is that i want to unpack the main ...
- 319
6
votes
1
answer
2k
views
Handling INT 2D anti-debugger technique in IDA Pro
I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging:
CODE:00455050 push ebp
CODE:00455051 mov ebp, esp
CODE:00455053 push ecx
CODE:00455054 push ebx
...
- 235
2
votes
3
answers
2k
views
ZwQueryInformationThread - what is it exactly?
By analyzing a piece of assembly code of a Trojan, I found a string "ZwQueryInformationThread". I assume that it is an anti-debugging technique because the process terminates after hitting that line.
...
- 1,541
5
votes
1
answer
4k
views
Why was my memory breakpoint not triggered in OllyDbg?
I am currently battling this protection on an 32-bit executable.
At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
- 181
2
votes
0
answers
408
views
What are the commercial anti reversing techniques? [closed]
I am interested in knowing about what are the latest commercial packages that are out there that deter reverse code engineering. And how do I work around them if necessary ? To be more specific I am ...
- 203
1
vote
2
answers
3k
views
Anti-cheat Memory Scan
The Problem
I'm attaching a game's process to view/edit my ammo. I've reversed a few games and understand x86 assembly; however, I'm new to the whole anti-debuggers and memory scanning bit. I have ...
- 21
-2
votes
1
answer
2k
views
How does this test for debugger [closed]
While reading a book it mentioned that the following code is usually used to as an antidebugger
mov eax, large fs:18h
mov eax, [eax+30h]
movzx eax, byte ptr [eax+2]
retn
I don't ...
- 135
0
votes
1
answer
2k
views
How do memory integrity checks work?
How does a memory integrity check work? For example, the .code memory region is scanned by this check and then changes can be detected and the program will return with an event that will exit the ...
- 39
0
votes
1
answer
596
views
HASP implementation details [closed]
I realize this is a huge question but any insight you can provide will be much appreciated. OK, let's consider a file protected/wrapped by HASP.
What's the general layout of said file? There's a HASP ...
- 1
0
votes
4
answers
239
views
What program can I use to detect protections used on a program and its libraries?
What are some good programs that can detect which protection software has been used on or in other programs and their libraries?
4
votes
1
answer
99
views
registers set by function
How can I figure out which general-purpose registers are modified by a function call. I am programming a Win32 Assembly program that calls IsDebuggerPresent(). According to MSDN, it will return a ...
- 113
5
votes
1
answer
769
views
OllyDbg FPU anti-debug
While playing around with FPU instructions I discovered an anti-debugging trick for
OllyDbg. I haven't found it in popular references so far.
First of all here it is.
fnsave [esp-100h]
cmp word ptr [...
2
votes
1
answer
5k
views
How to prevent application from killing OllyDbg
I want to run an OllyDbg and attach it to some starting later process.
But the problem is, that process is very aggressive: it kills OllyDbg on start, and I also can't run OllyDbg later because that ...
- 453
12
votes
5
answers
29k
views
Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?
Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
- 223
3
votes
2
answers
3k
views
How to detect a debugger using some "time" checking strategies?
I have seen several anti-debug strategies, and I am wondering if there are some anti-debugger methods that can evaluate the program running time, thus detecting the exist of debugger.
- 2,485
3
votes
2
answers
12k
views
Bypassing basic memory protection
I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory.
But ...
- 139
10
votes
2
answers
1k
views
What impact does noninvasive debugging have?
What impact does noninvasive user mode debugging with WinDbg have on the process?
Will it be detectable by the process?
Of course I could imagine that if the threads are suspended, differences in ...
- 970
6
votes
1
answer
9k
views
How to attach debugger to app if it has protection against attaching?
Sometimes I've tried to attach Ollydbg to applications those have some protection against debuggers, but I have never coded any of these applications and did not see this protection in many ...
- 261
8
votes
2
answers
2k
views
How to Attach debugger or start analysis of process that is debugging itself?
I need and advice on how to start an analysis, connect with debugger to a process that is already debugging itself. Are there any tools/plugins/techniques that might help during the analysis?
UPDATE
...
- 3,072
1
vote
1
answer
3k
views
How can I tell if an app is using anti-debug techniques? [closed]
How can I detect whether an application is using anti-debug techniques? I'm using OllyDbg (2.01beta).
- 113
2
votes
1
answer
585
views
Find out decrypted body of Polymorphic malware
I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its ...
- 161
14
votes
4
answers
7k
views
Debugger hiding plugin for WinDbg?
Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
- 685
22
votes
3
answers
19k
views
Detecting tracing in Linux
Under Linux it's possible to trace exactly the kernel system calls with strace.
ltrace can be used also to trace library calls.
I wonder if it's possible to detect if my executable is running under ...
- 4,845
19
votes
8
answers
28k
views
How to detect a virtualized environment?
What are the different ways for a program to detect that it executes inside a virtualized environment ? And, would it be possible to detect what kind of virtualization is used ?
- 19.2k
16
votes
4
answers
7k
views
INT 2D Anti-Forensic Method
Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
- 263
5
votes
1
answer
2k
views
What are good Windows anti-debug references? [closed]
What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?
- 6,704
8
votes
1
answer
919
views
Canonical method to circumvent the ZwSetInformationThread antidebugging technique
I'm sure many of you are familiar with this classic antidebug trick accomplished by calling ZwSetInformationThread with ThreadInformationClass set to 0x11. Although many OllyDbg modules exist for the ...
- 1,213
22
votes
3
answers
6k
views
Anti-debug techniques on Unix platforms?
I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more).
I am thinking about techniques such as the PTRACE test at the beginning of ...
- 19.2k